Sarbanes-Oxley Act (SOX) of 2002: A Summary

The Sarbanes-Oxley Act (SOX) of 2002 is a federal law that establishes requirements for corporate financial transparency, internal control, and data integrity. The regulation applies to all public companies in the United States as well as their external auditors.

Key Sections of SOX

Two key sections, 302 and 404, define the operational structure of SOX compliance.

Section 302: Corporate Responsibility for Financial Reports

Section 302 requires CEOs and CFOs to personally certify the accuracy of financial statements and the effectiveness of internal controls.

Section 404: Management Assessment of Internal Controls

Section 404 mandates both internal and independent external audits of those controls.

SOX Requirements Related to Internal Control over Financial Reporting (ICFR)

SOX defines multiple requirements related to internal control over financial reporting (ICFR). Tufin supports enforcement of the IT General Controls (ITGCs) that underpin this system, including access control, change management, and data integrity.

IT General Controls (ITGCs) and SOX Compliance

Several IT General Controls are crucial for maintaining SOX compliance:

Access Control

SOX requires that access to financial systems be restricted to authorized users based on job role and business need. This is based on the principle of least privilege and includes both logical access and physical safeguards.

Change Management

Any changes to systems that store or process financial data must be controlled, tested, documented, and approved before implementation.

Data Integrity

IT systems must be designed and maintained in a way that ensures data is protected from unauthorized alteration.

Audit Logging and Monitoring

All activity affecting financial systems must be logged and monitored for compliance.

How Tufin Helps with SOX Compliance

Need to strengthen IT controls for SOX compliance? Learn how Tufin helps enforce access control, change management, and audit documentation across financial systems. Executives are legally required to certify that internal controls are effective. Tufin helps organizations define and implement network access controls needed to meet SOX requirements.

Tufin provides administrators with clear visibility into policies and other controls governing access to applications and other network assets. With Tufin, you can evaluate the compliance and riskiness of every proposed configuration change before it is implemented. Tufin tracks every policy change across firewalls, routers, and cloud platforms.

Tufin enables reporting on segmentation policies, compliance violations, and access policy change activity across the hybrid network.

Images gallery